bootstrap-bookworm.sh 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312
  1. #!/bin/bash -e
  2. #----------
  3. # Interactive installation steps for Debian Bullseye from GRML using debootstrap
  4. # Design decisions
  5. # - Fokus on a simple setup, primarly for VMs
  6. # - One disk, one partion, swap-file in the same partion as safety net
  7. # - Use systemd whereever possible (network, ntp, cron, journald logging)
  8. # - Minimal number of packages & cloud kernel
  9. # - support for grub-pc and grub-efi
  10. # - random root and admin user password generation
  11. # - ssh on port 50101 limited to the admin user
  12. # Usage
  13. # # Boot grml
  14. # passwd root
  15. # grml-network
  16. # Start ssh
  17. # git clone https://git.in-ulm.de/ulpeters/bootstrap.git
  18. # cp config.sh.template config.sh # copy template
  19. # config-get-netconf-eth0.sh # get running grml network config
  20. # vi config.sh # update installation variables
  21. # bootstrap-bullseye.sh install # start installation
  22. # !! Note down the admin passwords and reboot
  23. # sudo /installer/bootstrap-bullseye.sh postinstall # run postinstall in the new system
  24. # Variables
  25. mnt="/mnt/root" # mountpoint for the root filesystem during installation
  26. hostname="somehost.example.com"
  27. partition="mbr-single"
  28. disk="/dev/vda" # lsblk --list
  29. disk1=$disk"1"
  30. disk0=$disk"p1" # efi partion, only relevant if partion="efi"
  31. netDev="eth0" # ip link
  32. netAddress="203.0.113.66/24"
  33. netGateway="203.0.113.1"
  34. netBroadcast="203.0.113.255"
  35. netDNS1="192.0.2.10"
  36. netDNS2="198.51.100.10"
  37. netNTP="pool.ntp.org"
  38. extraPackages=""
  39. [ -f ./config.sh ] && source config.sh
  40. # Setup network in grml
  41. grmlnetwork(){
  42. ip link show # list interfaces
  43. ip addr add $netAddress dev $netDev
  44. ip link set $netDev up
  45. ip route add default via $netGateway
  46. echo nameserver $netDNS1 >> /etc/resolv.conf
  47. echo nameserver $netDNS2 >> /etc/resolv.conf
  48. }
  49. install(){
  50. if [ "$partition" = "mbr-single" ]
  51. then
  52. #----------
  53. # Prepare disks
  54. # Parition disks -- pkg: parted
  55. parted $disk -s \
  56. mklabel msdos \
  57. mkpart primary ext4 512M 100% toggle 1 boot
  58. fdisk -l $disk
  59. # Format disks -- pkg: e2fsprogs dosfstools and to file system check
  60. mkfs.ext4 $disk1 && e2fsck $disk1
  61. fi
  62. # Prepare mount points and mount
  63. mkdir -p $mnt
  64. mount $disk1 $mnt
  65. # Create swapfile
  66. swapfile=$mnt/swapfile
  67. dd if=/dev/zero of=$swapfile bs=1M count=1024 status=progress # create 1GB file
  68. chmod 600 $swapfile #restric permissions
  69. mkswap $swapfile #format file
  70. #----------
  71. # Bootstrap -- pkg: debootstrap
  72. # Remark: Debootstrap does not install recommands!!
  73. debootstrap --variant=minbase --arch=amd64 bookworm $mnt http://ftp2.de.debian.org/debian/
  74. #----------
  75. # Configuration
  76. # Configure disk mounts
  77. # Or get UUID from blkid...
  78. cat >$mnt/etc/fstab <<EOL
  79. $disk1 / ext4 rw 0 0
  80. /swapfile none swap defaults 0 0
  81. EOL
  82. # Configure sources.list
  83. cat >$mnt/etc/apt/sources.list <<EOL
  84. deb http://deb.debian.org/debian bookworm main non-free-firmware
  85. # deb-src http://deb.debian.org/debian bookworm main non-free-firmware
  86. deb http://deb.debian.org/debian-security/ bookworm-security main non-free-firmware
  87. # deb-src http://deb.debian.org/debian-security/ bookworm-security main non-free-firmware
  88. deb http://deb.debian.org/debian bookworm-updates main non-free-firmware
  89. # deb-src http://deb.debian.org/debian bookworm-updates main non-free-firmware
  90. EOL
  91. # Configure hostname
  92. echo "127.0.0.1 $hostname" >> $mnt/etc/hosts
  93. echo "$hostname" > $mnt/etc/hostname
  94. #----------
  95. # Prepare chroot
  96. mount -o bind /dev $mnt/dev
  97. mount -o bind /dev/pts $mnt/dev/pts
  98. mount -t sysfs /sys $mnt/sys
  99. mount -t proc /proc $mnt/proc
  100. cp /proc/mounts $mnt/etc/mtab
  101. cp /etc/resolv.conf $mnt/etc/resolv.conf
  102. mkdir -p $mnt/installer
  103. cp $(dirname `realpath $0`)/*.sh $mnt/installer
  104. # Run script in chroot
  105. chroot $mnt /bin/bash /installer/bootstrap-bullseye.sh install2
  106. # Install bootloader
  107. $0 bootloader
  108. }
  109. #----------
  110. # Function executed within chroot
  111. install2(){
  112. source /installer/config.sh
  113. # Install basic system
  114. apt-get update
  115. apt-get install --yes \
  116. apt-utils dialog msmtp-mta \
  117. systemd-sysv locales tzdata haveged \
  118. linux-image-cloud-amd64 grub-pc \
  119. iproute2 netbase \
  120. ssh sudo molly-guard \
  121. less vim-tiny bash-completion pwgen lsof \
  122. dnsutils iputils-ping curl \
  123. $extraPackages
  124. # Upgrade and clean up
  125. apt-get upgrade --yes
  126. apt-get autoremove --yes
  127. apt-get clean --yes
  128. # Setup users and passwords
  129. [ -z $pwdAdmin ] && pwdAdmin=`pwgen --capitalize --numerals --ambiguous 12 1`
  130. useradd admin --create-home --shell /bin/bash
  131. echo "admin:$pwdAdmin" | chpasswd
  132. usermod -a -G sudo admin
  133. echo -e "\e[1;33;4;44mPassword for the user admin: $pwdAdmin\e[0m"
  134. pass=`pwgen --capitalize --numerals --ambiguous 12 1`
  135. [ -z $pwdRoot ] && pwdRoot=`pwgen --capitalize --numerals --ambiguous 12 1`
  136. echo "root:$pwdRoot" | chpasswd
  137. echo -e "\e[1;33;4;44mPassword for the user root: $pwdRoot\e[0m"
  138. # Harden SSHD
  139. sed -i -e 's/#Port 22/Port 50101/g' /etc/ssh/sshd_config
  140. sed -i -e 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/g' /etc/ssh/sshd_config
  141. # https://infosec.mozilla.org/guidelines/openssh.html
  142. # Allow admin to sudo without password
  143. echo AllowUsers admin >> /etc/ssh/sshd_config
  144. echo "admin ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/admin
  145. ## Configure network using systemd
  146. if [ -z $netAddress ]
  147. then
  148. ## Network OPTION 1 - DHCP
  149. cat >/etc/systemd/network/20-wired.network <<EOL
  150. [Match]
  151. Name=e*
  152. [Network]
  153. DHCP=ipv4
  154. IPv6PrivacyExtensions=false
  155. IPv6AcceptRA=false
  156. NTP=$netNTP
  157. EOL
  158. else
  159. ## Network OPTION 2 - static
  160. cat >/etc/systemd/network/20-wired.network <<EOL
  161. [Match]
  162. Name=$netDev
  163. [Network]
  164. Address=$netAddress
  165. Gateway=$netGateway
  166. Broadcast=$netBroadcast
  167. DNS=$netDNS1
  168. DNS=$netDNS2
  169. NTP=$netNTP
  170. EOL
  171. fi
  172. ## Setup systemd resolver
  173. apt-get install --yes systemd-resolved
  174. echo -e "\n# Disable local name resolution" >> /etc/systemd/resolved.conf
  175. echo "LLMNR=no" >> /etc/systemd/resolved.conf
  176. echo "MulticastDNS=no" >> /etc/systemd/resolved.conf
  177. systemctl enable systemd-networkd
  178. systemctl enable systemd-resolved
  179. # Limit journald logging to 1 month, 1 GB in total and split files per week
  180. mkdir -p /etc/systemd/journald.conf.d/
  181. cat >/etc/systemd/journald.conf.d/retention.conf <<EOL
  182. MaxRetentionSec=1month
  183. SystemMaxUse=1G
  184. MaxFileSec=1week
  185. EOL
  186. # Show errors in motd
  187. rm /etc/motd
  188. cat >/etc/update-motd.d/15-boot-errors<<EOL
  189. #!/bin/sh
  190. echo
  191. journalctl --boot --priority=3 --no-pager
  192. EOL
  193. chmod 755 /etc/update-motd.d/15-boot-errors
  194. # Setup keyboard layout
  195. cat >/etc/default/keyboard <<EOL
  196. XKBMODEL="pc105"
  197. XKBLAYOUT="de"
  198. XKBVARIANT="nodeadkeys"
  199. XKBOPTIONS=""
  200. BACKSPACE="guess"
  201. EOL
  202. # Leave chroot
  203. exit
  204. }
  205. bootloader(){
  206. # Install grub in the mbr
  207. if [ $partition="mbr-single" ]
  208. then
  209. chroot $mnt /bin/bash -c "grub-install $disk && update-grub"
  210. fi
  211. # Install grub in the efi partition
  212. if [ $partition="efi-crypt" ]
  213. then
  214. chroot $mnt /bin/bash -c \
  215. "grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=grub && update-grub"
  216. fi
  217. }
  218. unmount(){
  219. # Unmount if mounted
  220. ! mountpoint -q $mnt/proc || umount $mnt/proc
  221. ! mountpoint -q $mnt/sys || umount $mnt/sys
  222. ! mountpoint -q $mnt/dev/pts || umount $mnt/dev/pts
  223. ! mountpoint -q $mnt/dev || umount $mnt/dev
  224. ! mountpoint -q $mnt/root || umount $mnt/root
  225. ! mountpoint -q $mnt || umount $mnt
  226. # Delete mount-point if empty and not mounted
  227. [ -z "$(ls -A /mnt/)" ] && ! mountpoint -q $mnt && rm -R $mnt
  228. }
  229. postinstall(){
  230. ####----REBOOT into the new system, so we'll have dbus running
  231. localectl set-locale LANG=de_DE.UTF-8 # Default for LC_* variables not set.
  232. localectl set-locale LC_MESSAGES=en_US.UTF-8 # System messages.
  233. #localectl set-locale LC_RESPONSE=en_US.UTF-8 # How responses (such as Yes and No) appear
  234. update-locale
  235. timedatectl set-timezone Europe/Berlin
  236. }
  237. # Switch to functions...
  238. case $1 in
  239. grmlnetwork)
  240. echo Setup network in grml
  241. grmlnetwork
  242. ;;
  243. install)
  244. echo "Stage 1: Start installation"
  245. install
  246. ;;
  247. install2)
  248. echo "Stage 2: Start installation in chroot"
  249. install2
  250. ;;
  251. bootloader)
  252. echo "Stage 3: Install bootloader and unmount chroot"
  253. bootloader
  254. unmount
  255. echo "We're done and can reboot now"
  256. ;;
  257. postinstall)
  258. echo "Stage 4: Start post-installation in live system"
  259. postinstall
  260. ;;
  261. unmount)
  262. echo "Unmount chroot, e.g. in case installation fails"
  263. unmount
  264. ;;
  265. *)
  266. echo "Valid functions are: grmlnetwork, install, postinstall and unmount" >&2
  267. ;;
  268. esac